Security55 mSeptember 23, 2026, 11:54

CVE-2026-8932: curl/libcurl mTLS connection reuse flaw

CVE-2026-8932 in libcurl 7.7–8.20.0 lets an already-authenticated mTLS connection be reused across different client keys. Five client-certificate fields were excluded from the config match check; fixed in 8.21.0 released 2026-06-24.

DEV Community Open source

Affects libcurl 7.7–8.20.0; fixed in 8.21.0 released 2026-06-24
SSLKEY, SSLKEYTYPE, KEYPASSWD, SSLCERTTYPE and SSLKEYBLOB were not compared
Rated Low severity, classified as CWE-305 authentication bypass
Patch moved five fields into ssl_primary_config, touching 19 files

#Curl#Libcurl

Prismor: open-source runtime control plane for AI agents

Security

Goldman Sachs invests $400m in Israeli cybersecurity firm Cyera

Security

DataDome: 65% of tested websites failed to detect any of 10 bots

Security

CVE-2026-8932: curl/libcurl mTLS connection reuse flaw

Prismor: open-source runtime control plane for AI agents

Goldman Sachs invests $400m in Israeli cybersecurity firm Cyera

DataDome: 65% of tested websites failed to detect any of 10 bots

Meta and Singapore police act against 3.7m scam-linked accounts